<!DOCTYPE html>
<html lang="zh-CN">
<head>
  <meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=2">
<meta name="theme-color" content="#222">
<meta name="generator" content="Hexo 5.2.0">
  <link rel="apple-touch-icon" sizes="180x180" href="/images/apple-touch-icon-next.png">
  <link rel="icon" type="image/png" sizes="32x32" href="/images/favicon-32x32-next.png">
  <link rel="icon" type="image/png" sizes="16x16" href="/images/favicon-16x16-next.png">
  <link rel="mask-icon" href="/images/logo.svg" color="#222">

<link rel="stylesheet" href="/css/main.css">


<link rel="stylesheet" href="/lib/font-awesome/css/all.min.css">
  <link rel="stylesheet" href="/lib/pace/pace-theme-minimal.min.css">
  <script src="/lib/pace/pace.min.js"></script>

<script id="hexo-configurations">
    var NexT = window.NexT || {};
    var CONFIG = {"hostname":"sekla.cn","root":"/","scheme":"Muse","version":"7.8.0","exturl":false,"sidebar":{"position":"right","display":"post","padding":18,"offset":12,"onmobile":false},"copycode":{"enable":false,"show_result":false,"style":null},"back2top":{"enable":true,"sidebar":false,"scrollpercent":false},"bookmark":{"enable":false,"color":"#222","save":"auto"},"fancybox":false,"mediumzoom":false,"lazyload":false,"pangu":false,"comments":{"style":"tabs","active":"valine","storage":true,"lazyload":false,"nav":null},"algolia":{"hits":{"per_page":10},"labels":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found in ${time} ms"}},"localsearch":{"enable":false,"trigger":"auto","top_n_per_article":1,"unescape":false,"preload":false},"motion":{"enable":true,"async":false,"transition":{"post_block":"fadeIn","post_header":"slideDownIn","post_body":"slideDownIn","coll_header":"slideLeftIn","sidebar":"slideUpIn"}},"path":"search.xml"};
  </script>

  <meta name="description" content="Bomblab数据实验程序运行中有6个关卡（6个phase）(有一个隐藏phase），每个phase需要用户在终端上输入特定的字符或者数字才能通关，否则会引爆炸弹！那么如何才能知道输入什么内容呢？这需要你使用gdb工具反汇编出汇编代码，结合c语言文件找到每个关卡的入口函数。然后分析汇编代码，找到在每个phase程序段中，引导程序跳转到“explode_bomb”程序段的地方，并分析其成功跳转的条件">
<meta property="og:type" content="article">
<meta property="og:title" content="CSAPP-Bomblab">
<meta property="og:url" content="http://sekla.cn/2021/05/14/csapp-bomblab/index.html">
<meta property="og:site_name" content="Sekla&#39;s Blog">
<meta property="og:description" content="Bomblab数据实验程序运行中有6个关卡（6个phase）(有一个隐藏phase），每个phase需要用户在终端上输入特定的字符或者数字才能通关，否则会引爆炸弹！那么如何才能知道输入什么内容呢？这需要你使用gdb工具反汇编出汇编代码，结合c语言文件找到每个关卡的入口函数。然后分析汇编代码，找到在每个phase程序段中，引导程序跳转到“explode_bomb”程序段的地方，并分析其成功跳转的条件">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://i.loli.net/2021/05/11/QuKvihJjeFT2Cpt.png">
<meta property="og:image" content="https://i.loli.net/2021/05/11/J6KyhLip7Xtkcqg.png">
<meta property="og:image" content="https://i.loli.net/2021/05/11/Pt9wxVWICnFv6j7.png">
<meta property="og:image" content="https://i.loli.net/2021/05/11/SGKzgy3wsLTVpbj.png">
<meta property="og:image" content="https://i.loli.net/2021/05/11/WotpGlHZuBrznVc.png">
<meta property="og:image" content="https://i.loli.net/2021/05/11/sd6Hwjf4rp239ke.png">
<meta property="og:image" content="https://i.loli.net/2021/05/11/6LA4GyOoQsvuIej.png">
<meta property="og:image" content="https://i.loli.net/2021/05/11/M2ErA6zPSkwgGlL.png">
<meta property="og:image" content="https://i.loli.net/2021/05/12/fMYybS2HxsiaChm.png">
<meta property="og:image" content="https://i.loli.net/2021/05/12/2MbacRoB3pV96yv.png">
<meta property="og:image" content="https://i.loli.net/2021/05/12/t1P96gKmA5cYDwM.png">
<meta property="og:image" content="https://i.loli.net/2021/05/12/Xh1FprmAZLNMfIz.png">
<meta property="og:image" content="https://i.loli.net/2021/05/12/MiJg7wSk9PtRc2s.png">
<meta property="og:image" content="https://i.loli.net/2021/05/13/EvDLXx1lybKNjFJ.png">
<meta property="og:image" content="https://i.loli.net/2021/05/13/LQ7qXf2kAuiW4BN.png">
<meta property="og:image" content="https://i.loli.net/2021/05/13/sNeym1kOv85lw3D.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/Waue4m9jSklApi5.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/8GQvgREOYBrJtow.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/Waue4m9jSklApi5.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/CA5DYQEoHOUv1uJ.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/hrmJbiwfjxHKAPX.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/JOsfjmrd2U54Ex1.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/i1qepfEQPTBkYbC.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/8uNs5reV3IFzQWZ.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/19YMNk72jVceJwZ.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/76p3N2KMYAnvkiD.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/qI63BpurD4jzSHa.png">
<meta property="og:image" content="https://i.loli.net/2021/05/14/3LyiVogY2Pz1h4a.png">
<meta property="article:published_time" content="2021-05-14T11:00:00.000Z">
<meta property="article:modified_time" content="2021-10-18T14:39:08.129Z">
<meta property="article:author" content="Sekla">
<meta property="article:tag" content="gdb">
<meta property="article:tag" content="汇编">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://i.loli.net/2021/05/11/QuKvihJjeFT2Cpt.png">

<link rel="canonical" href="http://sekla.cn/2021/05/14/csapp-bomblab/">


<script id="page-configurations">
  // https://hexo.io/docs/variables.html
  CONFIG.page = {
    sidebar: "",
    isHome : false,
    isPost : true,
    lang   : 'zh-CN'
  };
</script>

  <title>CSAPP-Bomblab | Sekla's Blog</title>
  






  <noscript>
  <style>
  .use-motion .brand,
  .use-motion .menu-item,
  .sidebar-inner,
  .use-motion .post-block,
  .use-motion .pagination,
  .use-motion .comments,
  .use-motion .post-header,
  .use-motion .post-body,
  .use-motion .collection-header { opacity: initial; }

  .use-motion .site-title,
  .use-motion .site-subtitle {
    opacity: initial;
    top: initial;
  }

  .use-motion .logo-line-before i { left: initial; }
  .use-motion .logo-line-after i { right: initial; }
  </style>
</noscript>

  <script type="text/javascript" src="/js/my_js/clicklove.js"></script>
<!-- hexo injector head_end start -->
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@0.12.0/dist/katex.min.css">

<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/hexo-math@4.0.0/dist/style.css">
<!-- hexo injector head_end end --></head>

<body itemscope itemtype="http://schema.org/WebPage">
  <div class="container use-motion">
    <div class="headband"></div>

    <header class="header" itemscope itemtype="http://schema.org/WPHeader">
      <div class="header-inner"><div class="site-brand-container">
  <div class="site-nav-toggle">
    <div class="toggle" aria-label="切换导航栏">
      <span class="toggle-line toggle-line-first"></span>
      <span class="toggle-line toggle-line-middle"></span>
      <span class="toggle-line toggle-line-last"></span>
    </div>
  </div>

  <div class="site-meta">

    <a href="/" class="brand" rel="start">
      <span class="logo-line-before"><i></i></span>
      <h1 class="site-title">Sekla's Blog</h1>
      <span class="logo-line-after"><i></i></span>
    </a>
      <p class="site-subtitle" itemprop="description">Keep Learning Keep Doing</p>
  </div>

  <div class="site-nav-right">
    <div class="toggle popup-trigger">
    </div>
  </div>
</div>




<nav class="site-nav">
  <ul id="menu" class="main-menu menu">
        <li class="menu-item menu-item-home">

    <a href="/" rel="section"><i class="fa fa-home fa-fw"></i>首页</a>

  </li>
        <li class="menu-item menu-item-about">

    <a href="/about/" rel="section"><i class="fa fa-user fa-fw"></i>关于</a>

  </li>
        <li class="menu-item menu-item-tags">

    <a href="/tags/" rel="section"><i class="fa fa-tags fa-fw"></i>标签<span class="badge">14</span></a>

  </li>
        <li class="menu-item menu-item-categories">

    <a href="/categories/" rel="section"><i class="fa fa-th fa-fw"></i>分类<span class="badge">23</span></a>

  </li>
        <li class="menu-item menu-item-archives">

    <a href="/archives/" rel="section"><i class="fa fa-archive fa-fw"></i>归档<span class="badge">100</span></a>

  </li>
  </ul>
</nav>




</div>
    </header>

    
  <div class="back-to-top">
    <i class="fa fa-arrow-up"></i>
    <span>0%</span>
  </div>
  <div class="reading-progress-bar"></div>


    <main class="main">
      <div class="main-inner">
        <div class="content-wrap">
          

          <div class="content post posts-expand">
            

    
  
  
  <article itemscope itemtype="http://schema.org/Article" class="post-block" lang="zh-CN">
    <link itemprop="mainEntityOfPage" href="http://sekla.cn/2021/05/14/csapp-bomblab/">

    <span hidden itemprop="author" itemscope itemtype="http://schema.org/Person">
      <meta itemprop="image" content="/images/avatar.jpg">
      <meta itemprop="name" content="Sekla">
      <meta itemprop="description" content="Sekla">
    </span>

    <span hidden itemprop="publisher" itemscope itemtype="http://schema.org/Organization">
      <meta itemprop="name" content="Sekla's Blog">
    </span>
      <header class="post-header">
        <h1 class="post-title" itemprop="name headline">
          CSAPP-Bomblab
        </h1>

        <div class="post-meta">
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-calendar"></i>
              </span>
              <span class="post-meta-item-text">发表于</span>

              <time title="创建时间：2021-05-14 19:00:00" itemprop="dateCreated datePublished" datetime="2021-05-14T19:00:00+08:00">2021-05-14</time>
            </span>
              <span class="post-meta-item">
                <span class="post-meta-item-icon">
                  <i class="far fa-calendar-check"></i>
                </span>
                <span class="post-meta-item-text">更新于</span>
                <time title="修改时间：2021-10-18 22:39:08" itemprop="dateModified" datetime="2021-10-18T22:39:08+08:00">2021-10-18</time>
              </span>
            <span class="post-meta-item">
              <span class="post-meta-item-icon">
                <i class="far fa-folder"></i>
              </span>
              <span class="post-meta-item-text">分类于</span>
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/%E8%AE%A1%E7%AE%97%E6%9C%BA%E7%B3%BB%E7%BB%9F/" itemprop="url" rel="index"><span itemprop="name">计算机系统</span></a>
                </span>
                  ，
                <span itemprop="about" itemscope itemtype="http://schema.org/Thing">
                  <a href="/categories/%E8%AE%A1%E7%AE%97%E6%9C%BA%E7%B3%BB%E7%BB%9F/CSAPP%E5%AE%9E%E9%AA%8C%E7%B3%BB%E5%88%97/" itemprop="url" rel="index"><span itemprop="name">CSAPP实验系列</span></a>
                </span>
            </span>

          
            <span class="post-meta-item" title="阅读次数" id="busuanzi_container_page_pv" style="display: none;">
              <span class="post-meta-item-icon">
                <i class="fa fa-eye"></i>
              </span>
              <span class="post-meta-item-text">阅读次数：</span>
              <span id="busuanzi_value_page_pv"></span>
            </span><br>
            <span class="post-meta-item" title="本文字数">
              <span class="post-meta-item-icon">
                <i class="far fa-file-word"></i>
              </span>
                <span class="post-meta-item-text">本文字数：</span>
              <span>12k</span>
            </span>
            <span class="post-meta-item" title="阅读时长">
              <span class="post-meta-item-icon">
                <i class="far fa-clock"></i>
              </span>
                <span class="post-meta-item-text">阅读时长 &asymp;</span>
              <span>11 分钟</span>
            </span>

        </div>
      </header>

    
    
    
    <div class="post-body" itemprop="articleBody">

      
        <h2 id="Bomblab数据实验"><a href="#Bomblab数据实验" class="headerlink" title="Bomblab数据实验"></a>Bomblab数据实验</h2><p>程序运行中有6个关卡（6个phase）(有一个隐藏phase），每个phase需要用户在终端上输入特定的字符或者数字才能通关，否则会引爆炸弹！那么如何才能知道输入什么内容呢？这需要你使用gdb工具反汇编出汇编代码，结合c语言文件找到每个关卡的入口函数。然后分析汇编代码，找到在每个phase程序段中，引导程序跳转到“explode_bomb”程序段的地方，并分析其成功跳转的条件，以此为突破口寻找应该在命令行输入何种字符通关。</p>
<p>个人认为是非常有趣的一个实验，一步步发现计算机的奥秘~~</p>
<a id="more"></a>

<h2 id="实验内容"><a href="#实验内容" class="headerlink" title="实验内容"></a>实验内容</h2><p>首先收到文件bomb.c和一个可执行文件，首先分析bomb.c：</p>
<p>bomb.c由一堆前言铺垫和主要六个函数组成：phase_#与phase_defused()，并且在phase_#之前，input的值是由read_line()函数所返回，那么想要拆除炸弹可能就是要获取正确的input。</p>
<p>但是.c文件什么函数都没告诉我们，所以直接进入反汇编模式。</p>
<h3 id="phase-1"><a href="#phase-1" class="headerlink" title="phase_1"></a>phase_1</h3><p>运用gdb调试，设置断点后，反汇编phase_1函数：</p>
<p><img src="https://i.loli.net/2021/05/11/QuKvihJjeFT2Cpt.png" alt="bomblab_1"></p>
<p>可以看到在&lt;+18&gt;处调用函数string_not_equal，之后对寄存器eax执行test指令，即函数返回值，如果eax寄存器为0，设置ZF寄存器为1，则je执行跳转到&lt;+32&gt;，所以需要让%eax为0，可以跳过炸弹爆炸，发现在函数&lt;+3&gt;处执行将立即数0x804a244给0x4(%esp)，查看该地址处的字符串：</p>
<p><img src="https://i.loli.net/2021/05/11/J6KyhLip7Xtkcqg.png" alt="bomblab_2"></p>
<p>在函数&lt;+11&gt;处开始将0x20(%esp)地址处的内容给%eax，再将%eax的内容给(%esp)地址处，随后就调用了函数string_not_equal，所以可以肯定输入0x804a244处字符可以拆除炸弹。</p>
<p><strong>I am just a renegade hockey mom.</strong></p>
<p>至此phase_1成功拆除。</p>
<p><img src="https://i.loli.net/2021/05/11/Pt9wxVWICnFv6j7.png" alt="bomblab_3"></p>
<h3 id="phase-2"><a href="#phase-2" class="headerlink" title="phase_2"></a>phase_2</h3><p>反汇编phase_2函数，</p>
<p><img src="https://i.loli.net/2021/05/11/SGKzgy3wsLTVpbj.png" alt="bomblab_4"></p>
<p>phase_2调用了2次explode_bomb函数，首先是&lt;+0&gt;到&lt;+30&gt;段，&lt;+20&gt;处调用了read_six_numbers函数，根据函数名判断可能需要输入6个数字，&lt;+25&gt;将0x18(%esp)与立即数1相比较影响ZF，若输入的不为1则炸弹爆炸，则第一个数为1，&lt;+50&gt;比较%eax和(%ebx)值，从&lt;+37&gt;开始分析，首先将%esp+0x1c加载到%ebx中，&lt;+45&gt;将%ebx-0x4赋给%eax，然后将%eax中的值进行累加，最后比较，根据关系可知0x1c(%esp)为下一个数字存放地址，然后&lt;+45&gt;将1存入%eax，最后进行累加得到2，然后跳转到&lt;+59&gt;，%ebx将存下一个数，然后进行循环，根据6个数字函数，应该为<strong>1 2 4 8 16 32</strong>。</p>
<p><img src="https://i.loli.net/2021/05/11/WotpGlHZuBrznVc.png" alt="bomblab_5"></p>
<p>phase 2成功通过。</p>
<h3 id="phase-3"><a href="#phase-3" class="headerlink" title="phase_3"></a>phase_3</h3><p>反汇编phase_3函数：</p>
<p><img src="https://i.loli.net/2021/05/11/sd6Hwjf4rp239ke.png" alt="bomblab_6"></p>
<p><img src="https://i.loli.net/2021/05/11/6LA4GyOoQsvuIej.png" alt="bomblab_7"></p>
<p>首先注意到&lt;+42&gt;处，调用函数__isoc99_sscanf@plt，根据名字判断可能是isoc99标准的sscanf函数，接着判断函数返回值和2的大小，若返回值大于2则阻止炸弹爆炸，&lt;+27&gt;将立即数$0x804a28e给0x4(%esp)，关注到接下来汇编代码进行多次比较，首先发现0x804a28e地址处为</p>
<p><img src="https://i.loli.net/2021/05/11/M2ErA6zPSkwgGlL.png" alt="bomblab_8"></p>
<p>根据sscanf格式化输入转换规则，可知输入为整型，字符型，整形。所以应该输入3个对应字符成功才能让__isoc99_sscanf@plt函数返回值为3。&lt;+57&gt;后判断0x24(%esp)和7的值，所以第一个输入应小于7才能防止炸弹爆炸，然后将0x24(%esp)地址中的值给%eax后。解地址0x804a2a0+4*%eax计算，来跳转0x804a2a0+4*%eax中存放的地址值，这应该是switch语句，跳转到0x804a2a0为基址的跳转表中：</p>
<p><img src="https://i.loli.net/2021/05/12/fMYybS2HxsiaChm.png" alt="bomblab_9"></p>
<p>则输入为0时跳转到地址为0x8048cb，为&lt;+79&gt;位置，比较0x3be和第二个输入值，若等于则跳转到&lt;+330&gt;位置，比较%al与第三个输入值，相等则阻止炸弹爆炸，由于&lt;+79&gt;位置将0x6e赋给%eax，%al为0x6e即<strong>110</strong>。</p>
<p>固可以输入0 958 110。</p>
<p>110对应的字符是n，固可以输入一组答案为<strong>0 n 958</strong>。</p>
<p><img src="https://i.loli.net/2021/05/12/2MbacRoB3pV96yv.png" alt="bomblab_p3"></p>
<h3 id="phase-4"><a href="#phase-4" class="headerlink" title="phase_4"></a>phase_4</h3><p><img src="https://i.loli.net/2021/05/12/t1P96gKmA5cYDwM.png" alt="bomblab_p4disa"></p>
<p>反汇编代码如上，首先&lt;+34&gt;同样调用函数__isoc99_sscanf@plt，&lt;+19&gt;将立即数地址传入0x4(%esp)，直接查看，发现是”%d %d”，则这次输入的两个数应为整形变量。&lt;+39&gt;直接将函数返回值与2比较，不相等则炸弹直接爆炸，所以必须输入2个数。</p>
<p>&lt;+50&gt;执行js指令，判断%eax是否为负，&lt;+52&gt;若%eax值小于等于0xe炸弹不爆炸，则读入的第一个值应该小于等于14，&lt;+85&gt;调用函数func4，返回值不为6则炸弹爆炸，所以要让func4(x，#，#)返回6，x为第一个输入的参数，&lt;+95&gt;第二个参数与6相比，不相等则爆炸，所以读入的第二个参数为6。接下来需要观察func4的功能，反汇编f unc4，根据&lt;+62&gt;到&lt;+78&gt;初始func4(x,0,14);</p>
<p><img src="https://i.loli.net/2021/05/12/Xh1FprmAZLNMfIz.png" alt="bomblab_func4"></p>
<p> func4函数多次调用自身，可判断为递归函数，根据汇编代码逐行分析，&lt;+45&gt;-&lt;+53&gt;依次将func4的3个参数入栈，所以这里函数func4(int edx,int eax,int ecx).</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line">0x08048d15 &lt;+0&gt;:	sub    $0x1c,%esp		栈初始化</span><br><span class="line">0x08048d18 &lt;+3&gt;:	mov    %ebx,0x14(%esp)		</span><br><span class="line">0x08048d1c &lt;+7&gt;:	mov    %esi,0x18(%esp)		x</span><br><span class="line">0x08048d20 &lt;+11&gt;:	mov    0x20(%esp),%edx		</span><br><span class="line">0x08048d24 &lt;+15&gt;:	mov    0x24(%esp),%eax		</span><br><span class="line">0x08048d28 &lt;+19&gt;:	mov    0x28(%esp),%ebx		</span><br><span class="line">0x08048d2c &lt;+23&gt;:	mov    %ebx,%ecx		%ebx值给%ecx</span><br><span class="line">0x08048d2e &lt;+25&gt;:	sub    %eax,%ecx		%ecx-%eax</span><br><span class="line">0x08048d30 &lt;+27&gt;:	mov    %ecx,%esi		%ecx给%esi</span><br><span class="line">0x08048d32 &lt;+29&gt;:	shr    $0x1f,%esi		%esi逻辑右移31位(x&gt;&gt;31)</span><br><span class="line">0x08048d35 &lt;+32&gt;:	add    %esi,%ecx        相加(x&gt;&gt;31+x)</span><br><span class="line">0x08048d37 &lt;+34&gt;:	sar    %ecx				算术右移%ecx 1位,最后整合x&#x3D;(x&gt;&gt;31+x)&gt;&gt;1</span><br><span class="line">0x08048d39 &lt;+36&gt;:	add    %eax,%ecx		</span><br><span class="line">0x08048d3b &lt;+38&gt;:	cmp    %edx,%ecx		</span><br><span class="line">0x08048d3d &lt;+40&gt;:	jle    0x8048d56 &lt;func4+65&gt;</span><br></pre></td></tr></table></figure>

<p>根据汇编写成高级语言的形式：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">func4</span><span class="params">(<span class="keyword">int</span> edx,<span class="keyword">int</span> eax,<span class="keyword">int</span> ebx)</span></span>&#123;</span><br><span class="line">    <span class="keyword">int</span> ecx=ebx;</span><br><span class="line">    ecx=ecx-eax;</span><br><span class="line">    <span class="keyword">int</span> esi=ecx;</span><br><span class="line">    esi=<span class="number">0</span>;<span class="comment">//esi&gt;&gt;31;对于很小的数字，相当于清零</span></span><br><span class="line">    ecx=ecx+esi;</span><br><span class="line">    ecx=ecx/<span class="number">2</span>;<span class="comment">//ecx&gt;&gt;1;</span></span><br><span class="line">    ecx=ecx+eax;</span><br><span class="line">    <span class="keyword">if</span>(ecx&gt;edx)&#123;</span><br><span class="line">        ecx=ecx<span class="number">-1</span>;</span><br><span class="line">        <span class="keyword">return</span> <span class="number">2</span>*func4(edx,eax,ecx);</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span>&#123;</span><br><span class="line">        eax=<span class="number">0</span>;</span><br><span class="line">        <span class="keyword">if</span>(ecx==edx)</span><br><span class="line">            <span class="keyword">return</span> <span class="number">0</span>;</span><br><span class="line">		<span class="keyword">else</span></span><br><span class="line">            <span class="keyword">return</span> <span class="number">2</span>*func4(edx,ecx+<span class="number">1</span>,ebx)+<span class="number">1</span>;</span><br><span class="line">        </span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>初始输入为func4(x,0,14)，最后会运行到return 2*func4(edx,ecx+1,ebx)+1;一步步求解，根据程序验证func(6,0,14)返回值为6，满足条件。</p>
<p><img src="https://i.loli.net/2021/05/12/MiJg7wSk9PtRc2s.png" alt="bomblab_p4"></p>
<h3 id="phase5"><a href="#phase5" class="headerlink" title="phase5"></a>phase5</h3><p><img src="https://i.loli.net/2021/05/13/EvDLXx1lybKNjFJ.png" alt="bomblab_p5disas"></p>
<p>开始将%ebx入栈，随后将输入的字符串首地址给%ebx保存，&lt;+11&gt;调用函数string_length，函数返回值不为6则炸弹爆炸，根据函数名判断可能是返回一个字符串长度的函数，随后将%edx，%eax寄存器置零，并将M[%eax+%ebx]符号扩展给%ecx，即字符串首地址，%edx=M[4*%ecx+0x804a2c0]，并将%eax+1，与6比较，不相等则返回&lt;+36&gt;处，说明这一段是一个for循环，循环6次，循环结束之后比较0x3f与%edx的值，相等则炸弹不爆炸。</p>
<p>所以6字符经过循环相加应该为63。</p>
<p>查看0x804a2c0，发现是一个数组，直接打印数组所有内容：</p>
<p><img src="https://i.loli.net/2021/05/13/LQ7qXf2kAuiW4BN.png" alt="bomblab_p5array"></p>
<p>由于只能取到4倍的数组地址，要达成63的结果，可以是+0到+36范围内的数字。</p>
<p>可以输入一串071555</p>
<p><img src="https://i.loli.net/2021/05/13/sNeym1kOv85lw3D.png" alt="bomnblab_p5sc"></p>
<p>只要最后答案得到63即可。</p>
<h3 id="phase6"><a href="#phase6" class="headerlink" title="phase6"></a>phase6</h3><figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br><span class="line">39</span><br><span class="line">40</span><br><span class="line">41</span><br><span class="line">42</span><br><span class="line">43</span><br><span class="line">44</span><br><span class="line">45</span><br><span class="line">46</span><br><span class="line">47</span><br><span class="line">48</span><br><span class="line">49</span><br><span class="line">50</span><br><span class="line">51</span><br><span class="line">52</span><br><span class="line">53</span><br><span class="line">54</span><br><span class="line">55</span><br><span class="line">56</span><br><span class="line">57</span><br><span class="line">58</span><br><span class="line">59</span><br><span class="line">60</span><br><span class="line">61</span><br><span class="line">62</span><br><span class="line">63</span><br><span class="line">64</span><br><span class="line">65</span><br><span class="line">66</span><br><span class="line">67</span><br><span class="line">68</span><br><span class="line">69</span><br><span class="line">70</span><br></pre></td><td class="code"><pre><span class="line">Dump of assembler code for function phase_6:</span><br><span class="line">   0x08048e3a &lt;+0&gt;:	push   %esi</span><br><span class="line">   0x08048e3b &lt;+1&gt;:	push   %ebx</span><br><span class="line">   0x08048e3c &lt;+2&gt;:	sub    $0x44,%esp</span><br><span class="line">   0x08048e3f &lt;+5&gt;:	lea    0x10(%esp),%eax</span><br><span class="line">   0x08048e43 &lt;+9&gt;:	mov    %eax,0x4(%esp)</span><br><span class="line">   0x08048e47 &lt;+13&gt;:	mov    0x50(%esp),%eax  		参数</span><br><span class="line">   0x08048e4b &lt;+17&gt;:	mov    %eax,(%esp)   </span><br><span class="line">   0x08048e4e &lt;+20&gt;:	call   0x80492bb &lt;read_six_numbers&gt; 		调用函数read_six_numbers</span><br><span class="line">   0x08048e53 &lt;+25&gt;:	mov    $0x0,%esi</span><br><span class="line">   0x08048e58 &lt;+30&gt;:	mov    0x10(%esp,%esi,4),%eax eax&#x3D;esp+10</span><br><span class="line">   0x08048e5c &lt;+34&gt;:	sub    $0x1,%eax 		eax&#x3D;eax-1</span><br><span class="line">   0x08048e5f &lt;+37&gt;:	cmp    $0x5,%eax 		要eax&lt;&#x3D;5</span><br><span class="line">   0x08048e62 &lt;+40&gt;:	jbe    0x8048e69 &lt;phase_6+47&gt;</span><br><span class="line">   0x08048e64 &lt;+42&gt;:	call   0x8049186 &lt;explode_bomb&gt;</span><br><span class="line">   0x08048e69 &lt;+47&gt;:	add    $0x1,%esi 		esi&#x3D;1+esi</span><br><span class="line">   0x08048e6c &lt;+50&gt;:	cmp    $0x6,%esi        esi比6 </span><br><span class="line">   0x08048e6f &lt;+53&gt;:	je     0x8048ea4 &lt;phase_6+106&gt;</span><br><span class="line">   0x08048e71 &lt;+55&gt;:	mov    %esi,%ebx        ebx&#x3D;esi</span><br><span class="line">   0x08048e73 &lt;+57&gt;:	mov    0x10(%esp,%ebx,4),%eax 		eax&#x3D;4*ebx+esp+0x10</span><br><span class="line">   0x08048e77 &lt;+61&gt;:	cmp    %eax,0xc(%esp,%esi,4)		要eax!&#x3D;4*esi+esp+0xc</span><br><span class="line">   0x08048e7b &lt;+65&gt;:	jne    0x8048e82 &lt;phase_6+72&gt;		</span><br><span class="line">   0x08048e7d &lt;+67&gt;:	call   0x8049186 &lt;explode_bomb&gt;</span><br><span class="line">   0x08048e82 &lt;+72&gt;:	add    $0x1,%ebx ebx&#x3D;ebx+1</span><br><span class="line">   0x08048e85 &lt;+75&gt;:	cmp    $0x5,%ebx </span><br><span class="line">   0x08048e88 &lt;+78&gt;:	jle    0x8048e73 &lt;phase_6+57&gt;		ebx&lt;&#x3D;5到+57</span><br><span class="line">   0x08048e8a &lt;+80&gt;:	jmp    0x8048e58 &lt;phase_6+30&gt;		ebx&gt;5到+30 循环部分</span><br><span class="line">   0x08048e8c &lt;+82&gt;:	mov    0x8(%edx),%edx	</span><br><span class="line">   0x08048e8f &lt;+85&gt;:	add    $0x1,%eax</span><br><span class="line">   0x08048e92 &lt;+88&gt;:	cmp    %ecx,%eax</span><br><span class="line">   0x08048e94 &lt;+90&gt;:	jne    0x8048e8c &lt;phase_6+82&gt;</span><br><span class="line">   0x08048e96 &lt;+92&gt;:	mov    %edx,0x28(%esp,%esi,4)</span><br><span class="line">   0x08048e9a &lt;+96&gt;:	add    $0x1,%ebx</span><br><span class="line">   0x08048e9d &lt;+99&gt;:	cmp    $0x6,%ebx</span><br><span class="line">   0x08048ea0 &lt;+102&gt;:	jne    0x8048ea9 &lt;phase_6+111&gt;</span><br><span class="line">   0x08048ea2 &lt;+104&gt;:	jmp    0x8048ec0 &lt;phase_6+134&gt;</span><br><span class="line">   0x08048ea4 &lt;+106&gt;:	mov    $0x0,%ebx</span><br><span class="line">   0x08048ea9 &lt;+111&gt;:	mov    %ebx,%esi</span><br><span class="line">   0x08048eab &lt;+113&gt;:	mov    0x10(%esp,%ebx,4),%ecx</span><br><span class="line">   0x08048eaf &lt;+117&gt;:	mov    $0x1,%eax</span><br><span class="line">   0x08048eb4 &lt;+122&gt;:	mov    $0x804c13c,%edx</span><br><span class="line">   0x08048eb9 &lt;+127&gt;:	cmp    $0x1,%ecx</span><br><span class="line">   0x08048ebc &lt;+130&gt;:	jg     0x8048e8c &lt;phase_6+82&gt;</span><br><span class="line">   0x08048ebe &lt;+132&gt;:	jmp    0x8048e96 &lt;phase_6+92&gt;</span><br><span class="line">   0x08048ec0 &lt;+134&gt;:	mov    0x28(%esp),%ebx</span><br><span class="line">   0x08048ec4 &lt;+138&gt;:	mov    0x2c(%esp),%eax</span><br><span class="line">   0x08048ec8 &lt;+142&gt;:	mov    %eax,0x8(%ebx)</span><br><span class="line">   0x08048ecb &lt;+145&gt;:	mov    0x30(%esp),%edx</span><br><span class="line">   0x08048ecf &lt;+149&gt;:	mov    %edx,0x8(%eax)</span><br><span class="line">   0x08048ed2 &lt;+152&gt;:	mov    0x34(%esp),%eax</span><br><span class="line">   0x08048ed6 &lt;+156&gt;:	mov    %eax,0x8(%edx)</span><br><span class="line">   0x08048ed9 &lt;+159&gt;:	mov    0x38(%esp),%edx</span><br><span class="line">   0x08048edd &lt;+163&gt;:	mov    %edx,0x8(%eax)</span><br><span class="line">   0x08048ee0 &lt;+166&gt;:	mov    0x3c(%esp),%eax</span><br><span class="line">   0x08048ee4 &lt;+170&gt;:	mov    %eax,0x8(%edx)</span><br><span class="line">   0x08048ee7 &lt;+173&gt;:	movl   $0x0,0x8(%eax)</span><br><span class="line">   0x08048eee &lt;+180&gt;:	mov    $0x5,%esi</span><br><span class="line">   0x08048ef3 &lt;+185&gt;:	mov    0x8(%ebx),%eax</span><br><span class="line">   0x08048ef6 &lt;+188&gt;:	mov    (%eax),%edx</span><br><span class="line">   0x08048ef8 &lt;+190&gt;:	cmp    %edx,(%ebx)</span><br><span class="line">   0x08048efa &lt;+192&gt;:	jge    0x8048f01 &lt;phase_6+199&gt;</span><br><span class="line">   0x08048efc &lt;+194&gt;:	call   0x8049186 &lt;explode_bomb&gt;</span><br><span class="line">   0x08048f01 &lt;+199&gt;:	mov    0x8(%ebx),%ebx</span><br><span class="line">   0x08048f04 &lt;+202&gt;:	sub    $0x1,%esi</span><br><span class="line">   0x08048f07 &lt;+205&gt;:	jne    0x8048ef3 &lt;phase_6+185&gt;</span><br><span class="line">   0x08048f09 &lt;+207&gt;:	add    $0x44,%esp</span><br><span class="line">   0x08048f0c &lt;+210&gt;:	pop    %ebx</span><br><span class="line">   0x08048f0d &lt;+211&gt;:	pop    %esi</span><br><span class="line">   0x08048f0e &lt;+212&gt;:	ret    </span><br><span class="line">End of assembler dump.</span><br></pre></td></tr></table></figure>

<p>非常长一段的汇编代码，经过大概的分析后，猜测这一段是构建了一个6个整形变量的链表并进行操作，并且有多重循环，一步步来看，</p>
<p>首先观察到第二重循环有一个立即数$0x804c13c给%edx，用gdb examine该地址发现，是一个链表的第一个节点，接着索性顺着examine接下来的100个地址，发现：</p>
<p><img src="https://i.loli.net/2021/05/14/Waue4m9jSklApi5.png"></p>
<p>发现不止一个链表，且还有一个bomb_id的神秘数组，先忽略bomb_id，返回到汇编语言中，首先读取6个数字，构建一个链表，0x50(%esp)存放链表尾节点，查看read_six_numbers函数汇编代码：</p>
<p><img src="https://i.loli.net/2021/05/14/8GQvgREOYBrJtow.png"></p>
<p>观察到输入的数首先组成一个6个元素的顺序表，且在地址0x8048870进行格式化输入，全为%d，证明全为整形元素，且开辟了一段内存空间依次存放指向6个元素的指针。返回主函数&lt;+25&gt;处，首先&lt;+40&gt;以及前面一段进行了判断，判断顺序表最后一个元素减一是否小于5，设顺序表6个元素为abcdef，即f&lt;=6，然后再&lt;+47&gt;进入二重循环，&lt;+61&gt;和&lt;+78&gt;进行一次循环判断和内循环判断，目的是abcde不能与f相等，否则爆炸，随后内循环结束，跳转到&lt;+30&gt;，再次循环，可以判断外重循环即将顺序表中每一个元素与6相比且要小于等于，且表中每一个元素都互不相等。</p>
<p>第一个二重循环结束后，跳转到&lt;+106&gt;处，&lt;+122&gt;将以下地址的数给%edx，即47。</p>
<p><img src="https://i.loli.net/2021/05/14/Waue4m9jSklApi5.png"></p>
<p>随后再次在&lt;+130&gt;进入循环并判断，若顺序表尾元素大于1，跳转&lt;+82&gt;，%edx也变成原地址加8的地址的值，以第一次循环为例，即72，%eax+1（原来为1)，%eax不等于%ecx则继续循环，相当于以当前顺序表的数的大小作为循环次数，循环完毕后跳转至&lt;+92&gt;，然后再循环6次，相当于把上一次循环得到的数复制并存入相邻的地址，形成新的6元素顺序表。</p>
<p>继续运行&lt;+134&gt;，把新的顺序表第一个元素给%ebx，第二个给%eax，%eax中的元素又给第三个元素，第三个元素给%edx，第三个元素又给第四个元素，相当于双指针移动来分别赋值，最后以0结尾，将%esi置5，第三个元素给%eax，%eax中元素作为地址寻址给%edx，最后比较%edx和(%ebx)，需要(%ebx)&gt;=%edx，循环6次，即每次第二个元素都要大于第一个元素，即三个大于第一个，第四个大于第二个，第五个大于第六个，第六个大于第四个。</p>
<p>所以根据以上<strong>循环的要求找到数，首先需要输入的6个数组织成顺序表且互不相等且&lt;=6，然后将链表中的节点值取出放到临近的栈中保存，简单来说就是判断节点每前一个数是不是都比后一个大，即顺序表的值需要非递增。</strong></p>
<p>然后根据第二个循环把链表中的数取出即可。每一个数对应每个链表的头结点。</p>
<table>
<thead>
<tr>
<th>1</th>
<th>2</th>
<th>3</th>
<th>4</th>
<th>5</th>
<th>6</th>
</tr>
</thead>
<tbody><tr>
<td>303</td>
<td>724</td>
<td>785</td>
<td>296</td>
<td>282</td>
<td>189</td>
</tr>
</tbody></table>
<p>输入顺序是3 2 1 4 5 6</p>
<p><img src="https://i.loli.net/2021/05/14/CA5DYQEoHOUv1uJ.png" alt="bomblab_fi"></p>
<h3 id="secret-phase"><a href="#secret-phase" class="headerlink" title="secret_phase"></a>secret_phase</h3><p>在bomb.c最后说明：</p>
<blockquote>
<p>/* Wow, they got it!  But isn’t something… missing?  Perhaps something they overlooked?  Mua ha ha ha ha! */</p>
</blockquote>
<p>发现事情没有这么简单，首先反汇编phase_defused函数：</p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br><span class="line">29</span><br><span class="line">30</span><br><span class="line">31</span><br><span class="line">32</span><br><span class="line">33</span><br><span class="line">34</span><br><span class="line">35</span><br><span class="line">36</span><br><span class="line">37</span><br><span class="line">38</span><br></pre></td><td class="code"><pre><span class="line">Dump of assembler code for function phase_defused:</span><br><span class="line">   0x0804930b &lt;+0&gt;:	sub    $0x8c,%esp</span><br><span class="line">   0x08049311 &lt;+6&gt;:	mov    %gs:0x14,%eax</span><br><span class="line">   0x08049317 &lt;+12&gt;:	mov    %eax,0x7c(%esp)</span><br><span class="line">   0x0804931b &lt;+16&gt;:	xor    %eax,%eax</span><br><span class="line">   0x0804931d &lt;+18&gt;:	cmpl   $0x6,0x804c3cc</span><br><span class="line">   0x08049324 &lt;+25&gt;:	jne    0x8049398 &lt;phase_defused+141&gt;</span><br><span class="line">   0x08049326 &lt;+27&gt;:	lea    0x2c(%esp),%eax</span><br><span class="line">   0x0804932a &lt;+31&gt;:	mov    %eax,0x10(%esp)</span><br><span class="line">   0x0804932e &lt;+35&gt;:	lea    0x28(%esp),%eax</span><br><span class="line">   0x08049332 &lt;+39&gt;:	mov    %eax,0xc(%esp)</span><br><span class="line">   0x08049336 &lt;+43&gt;:	lea    0x24(%esp),%eax</span><br><span class="line">   0x0804933a &lt;+47&gt;:	mov    %eax,0x8(%esp)</span><br><span class="line">   0x0804933e &lt;+51&gt;:	movl   $0x804a469,0x4(%esp)</span><br><span class="line">   0x08049346 &lt;+59&gt;:	movl   $0x804c4d0,(%esp)</span><br><span class="line">   0x0804934d &lt;+66&gt;:	call   0x8048870 &lt;__isoc99_sscanf@plt&gt;</span><br><span class="line">   0x08049352 &lt;+71&gt;:	cmp    $0x3,%eax</span><br><span class="line">   0x08049355 &lt;+74&gt;:	jne    0x804938c &lt;phase_defused+129&gt;</span><br><span class="line">   0x08049357 &lt;+76&gt;:	movl   $0x804a472,0x4(%esp)</span><br><span class="line">   0x0804935f &lt;+84&gt;:	lea    0x2c(%esp),%eax</span><br><span class="line">   0x08049363 &lt;+88&gt;:	mov    %eax,(%esp)</span><br><span class="line">   0x08049366 &lt;+91&gt;:	call   0x8049074 &lt;strings_not_equal&gt;</span><br><span class="line">   0x0804936b &lt;+96&gt;:	test   %eax,%eax</span><br><span class="line">   0x0804936d &lt;+98&gt;:	jne    0x804938c &lt;phase_defused+129&gt;</span><br><span class="line">   0x0804936f &lt;+100&gt;:	movl   $0x804a338,(%esp)</span><br><span class="line">   0x08049376 &lt;+107&gt;:	call   0x8048800 &lt;puts@plt&gt;</span><br><span class="line">   0x0804937b &lt;+112&gt;:	movl   $0x804a360,(%esp)</span><br><span class="line">   0x08049382 &lt;+119&gt;:	call   0x8048800 &lt;puts@plt&gt;</span><br><span class="line">   0x08049387 &lt;+124&gt;:	call   0x8048f60 &lt;secret_phase&gt;</span><br><span class="line">   0x0804938c &lt;+129&gt;:	movl   $0x804a398,(%esp)</span><br><span class="line">   0x08049393 &lt;+136&gt;:	call   0x8048800 &lt;puts@plt&gt;</span><br><span class="line">   0x08049398 &lt;+141&gt;:	mov    0x7c(%esp),%eax</span><br><span class="line">   0x0804939c &lt;+145&gt;:	xor    %gs:0x14,%eax</span><br><span class="line">   0x080493a3 &lt;+152&gt;:	je     0x80493aa &lt;phase_defused+159&gt;</span><br><span class="line">   0x080493a5 &lt;+154&gt;:	call   0x80487d0 &lt;__stack_chk_fail@plt&gt;</span><br><span class="line">   0x080493aa &lt;+159&gt;:	add    $0x8c,%esp</span><br><span class="line">   0x080493b0 &lt;+165&gt;:	ret    </span><br><span class="line">End of assembler dump.</span><br></pre></td></tr></table></figure>

<p>如何进入隐藏关是一个问题，&lt;+18&gt;比较0x804c3cc地址上的值与6，查看地址：</p>
<p><img src="https://i.loli.net/2021/05/14/hrmJbiwfjxHKAPX.png"></p>
<p>由于是在输入了一个答案之后设置的断点，所以猜测这里的变量保存的是我们通过的关卡数，往下看汇编代码，说明我们必须完成所有66个关卡才能进入隐藏关卡。</p>
<p>发现在&lt;+66&gt;调用sscanf函数之前，调用了5个参数压栈，还有2个地址0x804a469和0x804c4d0，直接查看：</p>
<p><img src="https://i.loli.net/2021/05/14/JOsfjmrd2U54Ex1.png"></p>
<p>0x804a469保存的是sscanf的格式控制串，但是0x804c4d0也许只有当我们输入完所有答案才会出现：</p>
<p><img src="https://i.loli.net/2021/05/14/i1qepfEQPTBkYbC.png"></p>
<p>发现0x804c4d0地址保存的是phase4的答案，非常神奇。</p>
<p>&lt;+74&gt;随后把0x804a472地址上的值作为一个参数，调用函数strings_not_equal:</p>
<p><img src="https://i.loli.net/2021/05/14/8uNs5reV3IFzQWZ.png"></p>
<p>所以进入隐藏关的要点即第四关答案后加上DrEvil即可。</p>
<p>&lt;+124&gt;调用了secret_phase，反汇编：</p>
<p><img src="https://i.loli.net/2021/05/14/19YMNk72jVceJwZ.png"></p>
<p>我们进入隐藏关后，需要输入一个数字，这个数字会减1并和3e8比较，输入要小于等于3e9，随后进入函数fun7，且fun7的返回值要为6，不然炸弹爆炸，反汇编fun7:</p>
<p><img src="https://i.loli.net/2021/05/14/76p3N2KMYAnvkiD.png"></p>
<figure class="highlight plain"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br><span class="line">27</span><br><span class="line">28</span><br></pre></td><td class="code"><pre><span class="line">0x08048f0f &lt;+0&gt;:	push   %ebx</span><br><span class="line">0x08048f10 &lt;+1&gt;:	sub    $0x18,%esp</span><br><span class="line">0x08048f13 &lt;+4&gt;:	mov    0x20(%esp),%edx</span><br><span class="line">0x08048f17 &lt;+8&gt;:	mov    0x24(%esp),%ecx</span><br><span class="line">0x08048f1b &lt;+12&gt;:	test   %edx,%edx &#x2F;&#x2F;检测是否为0</span><br><span class="line">0x08048f1d &lt;+14&gt;:	je     0x8048f56 &lt;fun7+71&gt; &#x2F;&#x2F;为0就返回-1</span><br><span class="line">0x08048f1f &lt;+16&gt;:	mov    (%edx),%ebx</span><br><span class="line">0x08048f21 &lt;+18&gt;:	cmp    %ecx,%ebx &#x2F;&#x2F;比较给定地址数和输入</span><br><span class="line">0x08048f23 &lt;+20&gt;:	jle    0x8048f38 &lt;fun7+41&gt; &#x2F;&#x2F;小于等于就跳转</span><br><span class="line">0x08048f25 &lt;+22&gt;:	mov    %ecx,0x4(%esp) </span><br><span class="line">0x08048f29 &lt;+26&gt;:	mov    0x4(%edx),%eax &#x2F;&#x2F;传参地址+8</span><br><span class="line">0x08048f2c &lt;+29&gt;:	mov    %eax,(%esp)	&#x2F;&#x2F;传参</span><br><span class="line">0x08048f2f &lt;+32&gt;:	call   0x8048f0f &lt;fun7&gt; &#x2F;&#x2F;递归调用</span><br><span class="line">0x08048f34 &lt;+37&gt;:	add    %eax,%eax &#x2F;&#x2F;返回2*fun7</span><br><span class="line">0x08048f36 &lt;+39&gt;:	jmp    0x8048f5b &lt;fun7+76&gt;</span><br><span class="line">0x08048f38 &lt;+41&gt;:	mov    $0x0,%eax 	&#x2F;&#x2F;eax&#x3D;0</span><br><span class="line">0x08048f3d &lt;+46&gt;:	cmp    %ecx,%ebx	&#x2F;&#x2F;再次比较定地址数和输入</span><br><span class="line">0x08048f3f &lt;+48&gt;:	je     0x8048f5b &lt;fun7+76&gt;	&#x2F;&#x2F;相等结束</span><br><span class="line">0x08048f41 &lt;+50&gt;:	mov    %ecx,0x4(%esp)	&#x2F;&#x2F;传参</span><br><span class="line">0x08048f45 &lt;+54&gt;:	mov    0x8(%edx),%eax	&#x2F;&#x2F;传参地址+8</span><br><span class="line">0x08048f48 &lt;+57&gt;:	mov    %eax,(%esp)</span><br><span class="line">0x08048f4b &lt;+60&gt;:	call   0x8048f0f &lt;fun7&gt;</span><br><span class="line">0x08048f50 &lt;+65&gt;:	lea    0x1(%eax,%eax,1),%eax	&#x2F;&#x2F;返回2*fun7+1</span><br><span class="line">0x08048f54 &lt;+69&gt;:	jmp    0x8048f5b &lt;fun7+76&gt;</span><br><span class="line">0x08048f56 &lt;+71&gt;:	mov    $0xffffffff,%eax</span><br><span class="line">0x08048f5b &lt;+76&gt;:	add    $0x18,%esp</span><br><span class="line">0x08048f5e &lt;+79&gt;:	pop    %ebx</span><br><span class="line">0x08048f5f &lt;+80&gt;:	ret    </span><br></pre></td></tr></table></figure>

<p>根据汇编写出伪代码：</p>
<figure class="highlight c"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">int</span> <span class="title">fun7</span><span class="params">(node *x,<span class="keyword">int</span> y)</span></span>&#123;</span><br><span class="line">    <span class="keyword">int</span> eax=<span class="number">0</span> <span class="comment">//返回值</span></span><br><span class="line">    <span class="keyword">if</span>	!x &#123;</span><br><span class="line">        <span class="keyword">return</span> <span class="number">-1</span>;</span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">if</span>	*x&gt;y</span><br><span class="line">        <span class="keyword">return</span> <span class="number">2</span>*fun7(*(x+<span class="number">1</span>),y)</span><br><span class="line">    eax=<span class="number">0</span></span><br><span class="line">    <span class="keyword">if</span> *x!=y</span><br><span class="line">        eax=<span class="number">2</span>*fun7(*(x+<span class="number">2</span>),y)+<span class="number">1</span></span><br><span class="line">    <span class="keyword">return</span> eax</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>fun7函数需要返回6，首先查看fun7调用传入的参数地址为：  $0x804c088，查看地址：</p>
<p><img src="https://i.loli.net/2021/05/14/qI63BpurD4jzSHa.png"></p>
<p>发现是一个4层的BST；</p>
<p>要返回6，根据6-&gt;3-&gt;1-&gt;0逆推，所以递归顺序为大于大于小于，即左右右的顺序访问，根据内存组织的二叉树即输入值为<strong>0x23</strong>。</p>
<p>十进制为35。</p>
<p><img src="https://i.loli.net/2021/05/14/3LyiVogY2Pz1h4a.png"></p>
<p>至此bomblab所有关卡均已完成.The bomb has been defused.</p>

    </div>
    
    
    

      <footer class="post-footer">
          
          <div class="post-tags">
              <a href="/tags/gdb/" rel="tag"><i class="fa fa-tag"></i> gdb</a>
              <a href="/tags/%E6%B1%87%E7%BC%96/" rel="tag"><i class="fa fa-tag"></i> 汇编</a>
          </div>

        


        
    <div class="post-nav">
      <div class="post-nav-item">
    <a href="/2021/05/01/csapp-practice-three/" rel="prev" title="3个汇编求源码题">
      <i class="fa fa-chevron-left"></i> 3个汇编求源码题
    </a></div>
      <div class="post-nav-item">
    <a href="/2021/05/24/linux_timecnt/" rel="next" title="Linux性能评测工具Gprof">
      Linux性能评测工具Gprof <i class="fa fa-chevron-right"></i>
    </a></div>
    </div>
      </footer>
    
  </article>
  
  
  



          </div>
          

<script>
  window.addEventListener('tabs:register', () => {
    let { activeClass } = CONFIG.comments;
    if (CONFIG.comments.storage) {
      activeClass = localStorage.getItem('comments_active') || activeClass;
    }
    if (activeClass) {
      let activeTab = document.querySelector(`a[href="#comment-${activeClass}"]`);
      if (activeTab) {
        activeTab.click();
      }
    }
  });
  if (CONFIG.comments.storage) {
    window.addEventListener('tabs:click', event => {
      if (!event.target.matches('.tabs-comment .tab-content .tab-pane')) return;
      let commentClass = event.target.classList[1];
      localStorage.setItem('comments_active', commentClass);
    });
  }
</script>

        </div>
          
  
  <div class="toggle sidebar-toggle">
    <span class="toggle-line toggle-line-first"></span>
    <span class="toggle-line toggle-line-middle"></span>
    <span class="toggle-line toggle-line-last"></span>
  </div>

  <aside class="sidebar">
    <div class="sidebar-inner">

      <ul class="sidebar-nav motion-element">
        <li class="sidebar-nav-toc">
          文章目录
        </li>
        <li class="sidebar-nav-overview">
          站点概览
        </li>
      </ul>

      <!--noindex-->
      <div class="post-toc-wrap sidebar-panel">
          <div class="post-toc motion-element"><ol class="nav"><li class="nav-item nav-level-2"><a class="nav-link" href="#Bomblab%E6%95%B0%E6%8D%AE%E5%AE%9E%E9%AA%8C"><span class="nav-number">1.</span> <span class="nav-text">Bomblab数据实验</span></a></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E5%AE%9E%E9%AA%8C%E5%86%85%E5%AE%B9"><span class="nav-number">2.</span> <span class="nav-text">实验内容</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#phase-1"><span class="nav-number">2.1.</span> <span class="nav-text">phase_1</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#phase-2"><span class="nav-number">2.2.</span> <span class="nav-text">phase_2</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#phase-3"><span class="nav-number">2.3.</span> <span class="nav-text">phase_3</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#phase-4"><span class="nav-number">2.4.</span> <span class="nav-text">phase_4</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#phase5"><span class="nav-number">2.5.</span> <span class="nav-text">phase5</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#phase6"><span class="nav-number">2.6.</span> <span class="nav-text">phase6</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#secret-phase"><span class="nav-number">2.7.</span> <span class="nav-text">secret_phase</span></a></li></ol></li></ol></div>
      </div>
      <!--/noindex-->

      <div class="site-overview-wrap sidebar-panel">
        <div class="site-author motion-element" itemprop="author" itemscope itemtype="http://schema.org/Person">
    <img class="site-author-image" itemprop="image" alt="Sekla"
      src="/images/avatar.jpg">
  <p class="site-author-name" itemprop="name">Sekla</p>
  <div class="site-description" itemprop="description">Sekla</div>
</div>
<div class="site-state-wrap motion-element">
  <nav class="site-state">
      <div class="site-state-item site-state-posts">
          <a href="/archives/">
        
          <span class="site-state-item-count">100</span>
          <span class="site-state-item-name">日志</span>
        </a>
      </div>
      <div class="site-state-item site-state-categories">
            <a href="/categories/">
          
        <span class="site-state-item-count">23</span>
        <span class="site-state-item-name">分类</span></a>
      </div>
      <div class="site-state-item site-state-tags">
            <a href="/tags/">
          
        <span class="site-state-item-count">14</span>
        <span class="site-state-item-name">标签</span></a>
      </div>
  </nav>
</div>
  <div class="links-of-author motion-element">
      <span class="links-of-author-item">
        <a href="https://github.com/ShenTiao" title="GitHub → https:&#x2F;&#x2F;github.com&#x2F;ShenTiao" rel="noopener" target="_blank"><i class="fab fa-github fa-fw"></i>GitHub</a>
      </span>
      <span class="links-of-author-item">
        <a href="mailto:584892986@qq.com" title="E-Mail → mailto:584892986@qq.com" rel="noopener" target="_blank"><i class="fa fa-envelope fa-fw"></i>E-Mail</a>
      </span>
  </div>



      </div>

      <iframe frameborder="no" border="0" marginwidth="0" marginheight="0" width=330 height=86 src="//music.163.com/outchain/player?type=2&id=1416875904&auto=0&height=66"></iframe>
      
    </div>
  </aside>
  <div id="sidebar-dimmer"></div>


      </div>
    </main>

    <footer class="footer">
      <div class="footer-inner">
        

        

<div class="copyright">
  
  &copy; 
  <span itemprop="copyrightYear">2022</span>
  <span class="with-love">
    <i class="fa fa-heart"></i>
  </span>
  <span class="author" itemprop="copyrightHolder">Sekla</span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item-icon">
      <i class="fa fa-chart-area"></i>
    </span>
    <span title="站点总字数">288k</span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item-icon">
      <i class="fa fa-coffee"></i>
    </span>
    <span title="站点阅读时长">4:22</span>
</div>
  <div class="powered-by">由 <a href="https://hexo.io/" class="theme-link" rel="noopener" target="_blank">Hexo</a> & <a href="https://muse.theme-next.org/" class="theme-link" rel="noopener" target="_blank">NexT.Muse</a> 强力驱动
  </div>

        
<div class="busuanzi-count">
  <script async src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
    <span class="post-meta-item" id="busuanzi_container_site_uv" style="display: none;">
      <span class="post-meta-item-icon">
        <i class="fa fa-user"></i>
      </span>
      <span class="site-uv" title="总访客量">
        <span id="busuanzi_value_site_uv"></span>
      </span>
    </span>
    <span class="post-meta-divider">|</span>
    <span class="post-meta-item" id="busuanzi_container_site_pv" style="display: none;">
      <span class="post-meta-item-icon">
        <i class="fa fa-eye"></i>
      </span>
      <span class="site-pv" title="总访问量">
        <span id="busuanzi_value_site_pv"></span>
      </span>
    </span>
</div>








      </div>
    </footer>
  </div>

  
  <script size="300" alpha="0.6" zIndex="-1" src="/lib/canvas-ribbon/canvas-ribbon.js"></script>
  <script src="/lib/anime.min.js"></script>
  <script src="/lib/velocity/velocity.min.js"></script>
  <script src="/lib/velocity/velocity.ui.min.js"></script>

<script src="/js/utils.js"></script>

<script src="/js/motion.js"></script>


<script src="/js/schemes/muse.js"></script>


<script src="/js/next-boot.js"></script>




  















  

  
      

<script>
  if (typeof MathJax === 'undefined') {
    window.MathJax = {
      loader: {
        source: {
          '[tex]/amsCd': '[tex]/amscd',
          '[tex]/AMScd': '[tex]/amscd'
        }
      },
      tex: {
        inlineMath: {'[+]': [['$', '$']]},
        tags: 'ams'
      },
      options: {
        renderActions: {
          findScript: [10, doc => {
            document.querySelectorAll('script[type^="math/tex"]').forEach(node => {
              const display = !!node.type.match(/; *mode=display/);
              const math = new doc.options.MathItem(node.textContent, doc.inputJax[0], display);
              const text = document.createTextNode('');
              node.parentNode.replaceChild(text, node);
              math.start = {node: text, delim: '', n: 0};
              math.end = {node: text, delim: '', n: 0};
              doc.math.push(math);
            });
          }, '', false],
          insertedScript: [200, () => {
            document.querySelectorAll('mjx-container').forEach(node => {
              let target = node.parentNode;
              if (target.nodeName.toLowerCase() === 'li') {
                target.parentNode.classList.add('has-jax');
              }
            });
          }, '', false]
        }
      }
    };
    (function () {
      var script = document.createElement('script');
      script.src = '//cdn.jsdelivr.net/npm/mathjax@3/es5/tex-mml-chtml.js';
      script.defer = true;
      document.head.appendChild(script);
    })();
  } else {
    MathJax.startup.document.state(0);
    MathJax.texReset();
    MathJax.typeset();
  }
</script>

    

  

<script src="/live2dw/lib/L2Dwidget.min.js?094cbace49a39548bed64abff5988b05"></script><script>L2Dwidget.init({"pluginRootPath":"live2dw/","pluginJsPath":"lib/","pluginModelPath":"assets/","tagMode":false,"debug":false,"model":{"jsonPath":"/live2dw/assets/shizuku.model.json"},"display":{"position":"left","width":250,"height":500},"mobile":{"show":false},"react":{"opacity":0.9},"log":false});</script></body>
</html>

<script type="text/javascript" src="/js/src/love.js"></script>
